HackDig : Dig high-quality web security articles for hackers

Microsoft releases Azure Defender for IoT in public preview

2020-10-16 16:00

Microsoft releases Azure Defender for IoT in public preview

Microsoft announced today that Azure Defender for IoT, its agentless security solution for networked IoT and Operational Technology (OT) devices, has entered public preview.

Azure Defender for IoT is an IoT/OT device threat protection solution that integrates with Microsoft's Azure Sentinel and third-party solutions (SIEMs, CMDBs, and SOAR) to provide continuous threat monitoring and vulnerability management.

It focuses on providing security monitoring for specialized device types, applications, and machine-to-machine (M2M), as well as specialized industrial protocols (Modbus, DNP3, BACnet, etc.) within IoT/OT environments.

By adding visibility into misconfigured, unmanaged, and unpatched IoT/OT devices, it makes it a lot harder for threat actors to abuse them to gain a foothold into the networks of industrial and critical infrastructure organizations.

Azure Defender for IoT
Image: Microsoft

"You can deploy these capabilities fully on-premises without sending any data to Azure," Phil Neray, Director of Azure IoT Security Strategy, explained.

"Or, you can deploy in Azure-connected environments using our new native connector to integrate IoT/OT alerts into Azure Sentinel, benefiting from the scalability and cost benefits of the industry’s first cloud-native SIEM/SOAR platform."

The alerts sent by Azure Defender for IoT into Azure Sentinel are triggered by analytics detection engines for protocol violation, policy violation, industrial malware detection, anomaly detection, and operational incident detection included on sensors used to collect ICS network traffic.

These alerts are "based on analysis of both real-time and pre-recorded traffic" and they cover a wide range of incidents including but not limited to:

  • Unauthorized device connected to the network
  • Unauthorized connection to the internet
  • Unauthorized remote access
  • Network scanning operation detected
  • Unauthorized PLC programming
  • Changes to firmware versions
  • “PLC Stop” and other potentially malicious commands
  • Device is suspected of being disconnected
  • Ethernet/IP CIP service request failure
  • BACnet operation failed
  • Illegal DNP3 operation
  • Master-slave authentication error
  • Known malware detected (e.g., WannaCry, EternalBlue)
  • Unauthorized SMB login

"In addition, you can create custom alerts based on your knowledge of expected device behavior," according to Microsoft. "An alert acts as an indicator of potential compromise, and should be investigated and remediated."

Example of Azure Defender for IoT alert
Image: Microsoft

Azure Defender for IoT can be tried for free while in public preview, the only requirement being an Azure Defender subscription that is also free of charge for the first 30 days.

You can get started from the IoT Defender Dashboard and you can learn more about how to configure it and its capabilities from here.


Source: p-cilbup-ni-toi-rof-rednefed-eruza-sesaeler-tfosorcim/ytiruces/swen/moc.retupmocgnipeelb.www

Read:157 | Comments:0 | Tags:Security Microsoft

“Microsoft releases Azure Defender for IoT in public preview”0 Comments

Submit A Comment

Name:

Email:

Blog :

Verification Code:

Tools

Tag Cloud